Anticipated annual losses from various security threats identified for a small company.

This project uses spreadsheet software to calculateanticipated annual losses from various security threats identified for a smallcompany. Mercer Paints is a paint manufacturing company located in Alabama thatuses a network to link its business operations. A security risk assessmentrequested by management identified a number of potential exposures. Theseexposures, their associated probabilities, and average losses are summarized ina table, which can be found in this learning module. Use the table to answerthe following questions:

⢠In addition to the potential exposures listed, identify atleast three other potential threats to Mercer Paints, assign probabilities, andestimate a loss range.

⢠Use spreadsheet software and the risk assessment data tocalculate the expected annual loss for each exposure.

⢠Present your findings in the form of a chart. Whichcontrol points have the greatest vulnerability? What recommendations would youmake to Mercer Paints? Prepare a written report that summarizes your findingsand recommendations.

Setting securitypolicies and procedures really means developing a plan for how to deal withcomputer security. One way to approach this task is:

·Look at what you are trying to protect.

·Look at what you need to protect it from.

·Determine how likely the threats are.

·Implement measures that will protect your assetsin a cost-effective manner.

·Review the process continuously, and improvethings every time a weakness is found.

Reports should focus most on the last two steps, but the first threeare critically important to making effective decisions about security. One oldtruism in security is that the cost of protecting yourself against a threatshould be less than the cost of recovering if the threat were to strike you.Without reasonable knowledge of what you are protecting and what the likelythreats are, following this rule could be difficult.

Hands-on MIS

Improving Decision Making: Using Spreadsheet Software to Perform a Security Risk Assessment

Mercer Paints Risk Assessment

Exposure

Probability of Occurrence (%)

Average Loss ($)

Malware attack

60%

$75,000

Data loss

12%

$70,000

Embezzlement

3%

$30,000

User errors

85%

$25,000

Threats from hackers

95%

$90,000

Improper use by employees

35%

$5,000

Power failure

15%

$300,000

Hands-on MIS Security Vulnerabilities and Risk Assessment Tables

Management Decision Problem 2

SECURITY VULNERABILITIES BY TYPE OF COMPUTING PLATFORM

Platform Number of High Medium Low Total

Computers Risk Risk Risk Vulnerabilities

Windows Server

(corporate applications) 111 37 19

Windows 8 Enterprise

(high-level administrators) 3 56 242 87

Linux (e-mail and printing services) 1 3 154 98

Sun Solaris (UNIX)

(E-commerce and Web servers) 2 12 299 78

Windows 8 Enterprise user

desktops and laptops with office19514161,237

productivity tools that can also be

linked to the corporate network

running corporate applications and

intranet